Cloudflare Flexible SSL - is it worth it?


#1

On Cloudflare website it says flexible SSL “should only be used as a last resort if you are not able to setup SSL on your own web server. Be aware it can cause issues when you decide to switch away from it: How do I fix the infinite redirect loop.”

But it doesn’t detail what issues it can cause when you switch away from flexible SSL. Does anyone know what the issues are ?

And I am having the common redirect loop issue despite having the ‘Always use HTTPS’ rule setup & ‘Automatic HTTPS rewrites’ enabled. (My pages do load but cannot be tested on gtmetrix - always says ‘redirect loop detected’.

So I’m wondering if this flexible SSL setup is even worth dealing with. It’s supposed to be not actually secure but just looks good to visitors & may give a small seo boost. But free SSL is good and the only personal info my site might collect is email. So maybe it’s a suitable longterm solution ? But I’d like to know what kind of issues can arise should I ever need to switch away from flexible SSL.

Any suggestions or info appreciated, thanks.
Mike
https://www.bestdealsfind.com


#2

Cloudflare will proxy your site in any condition. Flexible SSL is good if there’s no way you can install an SSL certificate on your server. You shouldn’t change your server settings once you add it to Cloudflare. That’s usually where things go wrong. (some software, like WordPress, does get confused because it auto-rewrites HTTP(S) based upon your server settings)

To answer your question, yes, Flexible SSL is worth it. It gets you far more security than no SSL at all.

The biggest issue I see if you “switch away” from Flexible SSL is if you go back to no SSL…and you turned on HSTS Preload. Visitors will be looking for an HTTPS that doesn’t exist and their browser won’t let them use HTTP on your site.

Other than that, anything else is fixable.